@boxes-dev/dvb 1.0.42 → 1.0.44

package/dist/devbox/commands/init/index.js

@@ -1,7 +1,7 @@
 import path from "node:path";
 import fs from "node:fs/promises";
 import os from "node:os";
-import { cancel as clackCancel, confirm as clackConfirm, isCancel, log as clackLog, note as clackNote, select as clackSelect, taskLog as clackTaskLog, } from "@clack/prompts";
+import { cancel as clackCancel, confirm as clackConfirm, isCancel, taskLog as clackTaskLog, } from "@clack/prompts";
 import { resolveSocketInfo } from "@boxes-dev/core";
 import { createSecretStore, loadConfig, resolveCodexAuthMode, createSpritesClient, normalizeGitRemoteUrl, resolveSpritesApiUrl, resolveDevboxProjectDir, SpritesApiError, slugify, } from "@boxes-dev/core";
 import { DAEMON_TIMEOUT_MS, ensureDaemonRunning, requestJson, requireDaemonFeatures, } from "../../daemonClient.js";
@@ -9,19 +9,20 @@ import { ensureSpritesToken } from "../../auth.js";
 import { fetchSpriteDaemonRelease, getConvexUrl, issueSpriteDaemonToken, } from "../../controlPlane.js";
 import { logger } from "../../logger.js";
 import { parseInitArgs } from "./args.js";
-import { confirmCopyWorktree, findRepoRoot, ensureRepoProjectId, mapGlobalGitConfigDestinations, readGlobalGitConfigFiles, readHeadState, readRepoOrigin, readWorktreeState, resolveGitCommonDir, runCommand, } from "./repo.js";
-import { createFileListArchive, createGitMetaArchive, writePatch, } from "./packaging.js";
-import { bootstrapDevbox, ensureSpriteDaemonService, expandHome, ensureWeztermMuxService, installSpriteDaemon, shellQuote, stageRemoteSetupArtifacts, } from "./remote.js";
+import { runInitStatusFlow } from "./statusFlow.js";
+import { createCodexCheckpointRecorder, createInitStateUpdater, prepareInitSessionState, } from "./session.js";
+import { findRepoRoot, ensureRepoProjectId, readRepoOrigin } from "./repo.js";
+import { bootstrapDevbox, ensureSpriteDaemonService, expandHome, ensureWeztermMuxService, installSpriteDaemon, shellQuote, } from "./remote.js";
 import { ensureWeztermMuxInstalled } from "../../../wezterm/ensureMux.js";
-import { readRepoMarker, writeRepoMarker } from "./registry.js";
-import { showCopyableUrl } from "../../ui/copyableUrl.js";
-import { INIT_STEP_KEYS, readInitState, writeInitState, } from "./state.js";
-import { ensureSshConfig, ensureSshKey, copyToClipboard, openBrowser, parseGitRemote, readRemoteOrigin, setRemoteOrigin, verifySshAuth, } from "./ssh.js";
+import { readRepoMarker } from "./registry.js";
+import { readInitState, writeInitState } from "./state.js";
 import { ensureKnownHostsFile, ensureLocalMountKey, ensureRemoteMountAccess, ensureSshdService, readLocalMountPublicKey, } from "../mountSsh.js";
-import { createSetupArtifacts, promptForPlanApproval, promptForServicesApproval, readSetupPlan, readSetupEnvSecretsPlan, readSetupExternalPlan, readSetupExtraArtifactsPlan, readServicesPlan, runLocalServicesScan, runLocalSetupEnvSecretsScan, runLocalSetupExternalScan, runLocalSetupExtraArtifactsScan, runRemoteCodexSetup, ensureRemoteCodexInstalled, uploadSetupPlan, mergeSetupScans, writeSetupPlan, writeSetupEnvSecretsSchema, writeSetupExternalSchema, writeSetupExtraArtifactsSchema, writeServicesSchema, } from "./codex/index.js";
-import { mergeServicesToml, splitShellCommand, } from "../servicesToml.js";
+import { ensureRemoteCodexInstalled } from "./codex/index.js";
 import { checkSpriteExists, destroySpriteAndClearState, } from "../destroyShared.js";
 import { runInitStep } from "./progress.js";
+import { runSetupPlanFlow } from "./setupPlanFlow.js";
+import { runProvisionFlow } from "./provisionFlow.js";
+import { runFinalizeFlow } from "./finalizeFlow.js";
 const requireDaemonJsonOk = (response, label) => {
     if (response.status >= 200 && response.status < 300) {
         return response.body;
@@ -61,7 +62,21 @@ const DEFAULT_INIT_STEP_RETRIES = 3;
 const INIT_STEP_RETRYABLE_STATUSES = new Set([
     408, 409, 425, 429, 500, 502, 503, 504,
 ]);
+const ALIAS_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const RESERVED_ALIAS_PATTERN = /^dvb-[a-f0-9]{12}-/;
 const delay = async (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const normalizeAlias = (value) => value.trim().toLowerCase();
+const validateAlias = (alias) => {
+    if (!alias) {
+        throw new Error("Alias is required.");
+    }
+    if (RESERVED_ALIAS_PATTERN.test(alias)) {
+        throw new Error(`Alias "${alias}" is reserved. Choose an alias that does not start with dvb-<12 hex>-.`);
+    }
+    if (!ALIAS_PATTERN.test(alias)) {
+        throw new Error(`Invalid alias "${alias}". Use lowercase letters, numbers, and dashes.`);
+    }
+};
 const computeRetryDelayMs = (retryIndex) => {
     // retryIndex is 1-based (1..N)
     const base = 500;
@@ -161,6 +176,8 @@ const migrateLegacyRepoDevboxDir = async ({ repoRoot, projectDir, }) => {
         "setup.json",
         "setup-artifacts.tgz",
         "setup-artifacts.json",
+        "setup-artifacts.parts",
+        "setup-artifacts.parts.json",
         "scans",
         "logs",
     ];
@@ -182,27 +199,6 @@ const migrateLegacyRepoDevboxDir = async ({ repoRoot, projectDir, }) => {
         }
     }
 };
-const buildServicesTomlUpdates = (services) => {
-    const updates = {};
-    for (const service of services) {
-        const name = service.name.trim();
-        if (!name) {
-            throw new Error("Service name is required in setup.json services.");
-        }
-        const parts = splitShellCommand(service.command ?? "");
-        const [cmd, ...args] = parts;
-        if (!cmd) {
-            throw new Error(`Service "${name}" is missing a command.`);
-        }
-        updates[name] = {
-            name,
-            cmd,
-            ...(args.length > 0 ? { args } : {}),
-            ...(service.httpPort !== null ? { httpPort: service.httpPort } : {}),
-        };
-    }
-    return updates;
-};
 const extractCheckpointId = (events) => {
     const idPattern = /\bv\d+\b/;
     const matchId = (value) => {
@@ -229,195 +225,10 @@ const extractCheckpointId = (events) => {
     }
     return null;
 };
-const writeRemoteServicesToml = async ({ client, canonical, workdir, services, }) => {
-    if (services.length === 0)
-        return;
-    let baseContent = "";
-    try {
-        const bytes = await client.readFile(canonical, {
-            path: "devbox.toml",
-            workingDir: workdir,
-        });
-        baseContent = Buffer.from(bytes).toString("utf8");
-    }
-    catch (error) {
-        if (!(error instanceof SpritesApiError && error.status === 404)) {
-            throw error;
-        }
-    }
-    const updates = buildServicesTomlUpdates(services);
-    if (Object.keys(updates).length === 0)
-        return;
-    const merged = mergeServicesToml(baseContent, updates);
-    await client.writeFile(canonical, path.posix.join(workdir.replace(/\/$/, ""), "devbox.toml"), Buffer.from(merged));
-};
-const enableRemoteServices = async ({ client, canonical, services, status, }) => {
-    if (services.length === 0)
-        return;
-    logger.info("init_services_enable_start", {
-        box: canonical,
-        serviceCount: services.length,
-    });
-    for (const service of services) {
-        const name = service.name.trim();
-        if (!name) {
-            throw new Error("Service name is required in setup.json services.");
-        }
-        status?.stage(`Enabling service: ${name}`);
-        const parts = splitShellCommand(service.command ?? "");
-        const [cmd, ...args] = parts;
-        if (!cmd) {
-            throw new Error(`Service "${name}" is missing a command.`);
-        }
-        const input = {
-            cmd,
-            ...(args.length > 0 ? { args } : {}),
-            ...(service.httpPort !== null ? { httpPort: service.httpPort } : {}),
-        };
-        await client.createService(canonical, name, input);
-    }
-    logger.info("init_services_enable_complete", { box: canonical });
-};
 const throwInitCanceled = () => {
     clackCancel("Init canceled.");
     throw new Error("Init canceled.");
 };
-const promptBeforeOpenBrowser = async ({ url, title, consequence, }) => {
-    if (!process.stdin.isTTY)
-        return false;
-    showCopyableUrl(url, title);
-    const choice = await clackSelect({
-        message: `Open ${title} in your browser?`,
-        options: [
-            { value: "open", label: "Open in browser" },
-            { value: "skip", label: "Skip" },
-        ],
-        initialValue: "open",
-    });
-    if (isCancel(choice)) {
-        throwInitCanceled();
-    }
-    if (choice === "skip") {
-        clackLog.warn(consequence);
-        return false;
-    }
-    return true;
-};
-const toPosixPath = (value) => value.split(path.sep).join(path.posix.sep);
-const toRepoRelativePath = (repoRoot, filePath) => {
-    const resolved = path.isAbsolute(filePath)
-        ? filePath
-        : path.resolve(repoRoot, filePath);
-    const relative = path.relative(repoRoot, resolved) || filePath;
-    return toPosixPath(relative);
-};
-const isOutsideRepoPath = (relativePath) => relativePath === ".." || relativePath.startsWith(`..${path.posix.sep}`);
-const ensureWorkdirOwnership = async ({ client, canonical, workdir, status, }) => {
-    const checkResult = await client.exec(canonical, [
-        "/bin/bash",
-        "-lc",
-        [
-            "set -euo pipefail",
-            `dir=${shellQuote(workdir)}`,
-            'if [ ! -d "$dir" ]; then',
-            '  echo "Missing workdir: $dir" >&2',
-            "  exit 1",
-            "fi",
-            'stat -c %U "$dir"',
-        ].join("\n"),
-    ]);
-    if (checkResult.exitCode !== 0) {
-        const details = checkResult.stderr || checkResult.stdout || "";
-        throw new Error(details
-            ? `Failed to check workdir ownership: ${details.trim()}`
-            : `Failed to check workdir ownership (exit ${checkResult.exitCode})`);
-    }
-    const owner = checkResult.stdout.trim();
-    if (!owner || owner === "sprite")
-        return;
-    status.stage("Fixing workdir ownership");
-    const chownResult = await client.exec(canonical, [
-        "/bin/bash",
-        "-lc",
-        `sudo -n chown -R sprite:sprite ${shellQuote(workdir)}`,
-    ]);
-    if (chownResult.exitCode !== 0) {
-        const details = chownResult.stderr || chownResult.stdout || "";
-        throw new Error(details
-            ? `Failed to update workdir ownership: ${details.trim()}`
-            : `Failed to update workdir ownership (exit ${chownResult.exitCode})`);
-    }
-};
-const ensureGitSafeDirectory = async ({ client, canonical, workdir, status, }) => {
-    status.stage("Configuring git safe.directory");
-    logger.info("init_git_safe_directory_configure_start", {
-        box: canonical,
-        workdir,
-    });
-    const script = [
-        "set -euo pipefail",
-        `repo=${shellQuote(workdir)}`,
-        'if [ ! -d "$repo" ]; then',
-        '  echo "Missing repo workdir: $repo" >&2',
-        "  exit 1",
-        "fi",
-        'if [ ! -d "$repo/.git" ]; then',
-        "  exit 0",
-        "fi",
-        "if ! command -v git >/dev/null 2>&1; then",
-        "  exit 0",
-        "fi",
-        "",
-        "ensure_safe_in_file() {",
-        '  cfg="$1"',
-        '  existing="$(git config --file "$cfg" --get-all safe.directory 2>/dev/null || true)"',
-        '  if printf \'%s\\n\' "$existing" | grep -Fxq "$repo"; then',
-        "    return 0",
-        "  fi",
-        '  git config --file "$cfg" --add safe.directory "$repo"',
-        "}",
-        "",
-        // Ensure the repo is trusted for the sprite user (most devbox flows).
-        'ensure_safe_in_file "/home/sprite/.gitconfig"',
-        // If we created/modified the file as root, best-effort fix the owner.
-        'if [ "$(id -u)" -eq 0 ]; then',
-        "  chown sprite:sprite /home/sprite/.gitconfig >/dev/null 2>&1 || true",
-        "elif command -v sudo >/dev/null 2>&1; then",
-        "  sudo -n chown sprite:sprite /home/sprite/.gitconfig >/dev/null 2>&1 || true",
-        "fi",
-        "",
-        // Best-effort: also trust the repo for root, in case tools run git as root.
-        'if [ "$(id -u)" -eq 0 ]; then',
-        '  ensure_safe_in_file "/root/.gitconfig"',
-        "elif command -v sudo >/dev/null 2>&1; then",
-        '  root_existing="$(sudo -n git config --file /root/.gitconfig --get-all safe.directory 2>/dev/null || true)"',
-        '  if ! printf \'%s\\n\' "$root_existing" | grep -Fxq "$repo"; then',
-        '    sudo -n git config --file /root/.gitconfig --add safe.directory "$repo" >/dev/null 2>&1 || true',
-        "  fi",
-        "fi",
-    ].join("\n");
-    const result = await client.exec(canonical, [
-        "/bin/bash",
-        "--noprofile",
-        "--norc",
-        "-e",
-        "-u",
-        "-o",
-        "pipefail",
-        "-c",
-        script,
-    ]);
-    if (result.exitCode !== 0) {
-        const details = result.stderr || result.stdout || "";
-        throw new Error(details
-            ? `Failed to configure git safe.directory: ${details.trim()}`
-            : `Failed to configure git safe.directory (exit ${result.exitCode})`);
-    }
-    logger.info("init_git_safe_directory_configure_complete", {
-        box: canonical,
-        workdir,
-    });
-};
 export const runInit = async (args) => {
     const parsed = parseInitArgs(args);
     const progressEnabled = process.stdout.isTTY && !parsed.json;
@@ -474,536 +285,62 @@ export const runInit = async (args) => {
         const { repoRoot, repoName, slug, localHomeDir, projectId, projectDir, repoMarker, origin, normalizedOrigin, fingerprint, } = detected;
         let initState = detected.initState;
         const initFingerprintMismatch = detected.initFingerprintMismatch;
-        if (parsed.status) {
-            if (parsed.resume ||
-                parsed.force ||
-                parsed.yes ||
-                parsed.codexSetupOnly ||
-                parsed.alias ||
-                parsed.name) {
-                throw new Error("`dvb init --status` cannot be combined with other init flags (except --json).");
-            }
-            const socketInfo = resolveSocketInfo();
-            let daemonError = null;
-            let registryProject = null;
-            try {
-                await ensureDaemonRunning(socketInfo.socketPath);
-                await requireDaemonFeatures(socketInfo.socketPath, ["registry"]);
-                const existingProject = await requestJson(socketInfo.socketPath, "GET", `/registry/project?fingerprint=${encodeURIComponent(fingerprint)}`, DAEMON_TIMEOUT_MS.registry);
-                registryProject =
-                    requireDaemonJsonOk(existingProject, "Loading registry project (/registry/project)").project ?? null;
-            }
-            catch (error) {
-                daemonError = error instanceof Error ? error.message : String(error);
-            }
-            const localStatus = initState && !initFingerprintMismatch
-                ? resolveInitStatus(initState.steps, initState.complete)
-                : null;
-            const recommendsResume = Boolean(initState && !initFingerprintMismatch && !initState.complete);
-            const recommendsInit = !registryProject && (!initState || initFingerprintMismatch);
-            const recommendsForce = !recommendsResume &&
-                (!initState || initFingerprintMismatch) &&
-                Boolean(registryProject?.initStatus &&
-                    registryProject.initStatus !== "complete");
-            const lines = [];
-            const markerPath = path.join(projectDir, "box.json");
-            const checkpointPath = path.join(projectDir, "init-state.json");
-            lines.push("INIT STATUS");
-            lines.push("");
-            lines.push("Repo");
-            lines.push(`  root: ${repoRoot}`);
-            lines.push(`  origin: ${normalizedOrigin ?? origin ?? "(none)"}`);
-            lines.push(`  projectId (git config devbox.projectId): ${projectId}`);
-            lines.push(`  local state dir: ${projectDir}`);
-            lines.push("");
-            lines.push("Local state");
-            if (repoMarker?.canonical) {
-                lines.push(`  box marker (${markerPath}): present (alias: ${repoMarker.alias ?? "(none)"}, box: ${repoMarker.canonical})`);
-            }
-            else {
-                lines.push(`  box marker (${markerPath}): missing`);
-            }
-            if (initState) {
-                const completeText = initFingerprintMismatch
-                    ? `${String(Boolean(initState.complete))} (projectId mismatch)`
-                    : String(Boolean(initState.complete));
-                lines.push(`  init checkpoint (${checkpointPath}): present (updated: ${initState.updatedAt}, complete: ${completeText})`);
-                if (initState.canonical || initState.alias || initState.workdir) {
-                    lines.push(`    box: ${initState.canonical ?? "(unknown)"} (alias: ${initState.alias ?? "(unknown)"})`);
-                    lines.push(`    workdir: ${initState.workdir ?? "(unknown)"}`);
-                }
-                if (initState.checkpoints?.preCodexSetup ||
-                    initState.checkpoints?.postCodexSetup) {
-                    const pre = initState.checkpoints?.preCodexSetup;
-                    const post = initState.checkpoints?.postCodexSetup;
-                    lines.push("    snapshots:");
-                    if (pre) {
-                        lines.push(`      pre-codex-setup: ${pre.id} (created: ${pre.createdAt})`);
-                    }
-                    if (post) {
-                        lines.push(`      post-codex-setup: ${post.id} (created: ${post.createdAt})`);
-                    }
-                }
-                if (localStatus) {
-                    lines.push(`  inferred init status: ${localStatus}`);
-                }
-                lines.push("  steps:");
-                const steps = initState.steps ?? {};
-                for (const key of INIT_STEP_KEYS) {
-                    lines.push(`    ${key}: ${steps[key] ? "yes" : "no"}`);
-                }
-            }
-            else {
-                lines.push(`  init checkpoint (${checkpointPath}): missing`);
-            }
-            lines.push("");
-            lines.push("Registry");
-            lines.push(`  daemon socket: ${socketInfo.socketPath}`);
-            if (daemonError) {
-                lines.push(`  daemon: unavailable (${daemonError})`);
-            }
-            else if (registryProject) {
-                lines.push("  project: present");
-                lines.push(`    box: ${registryProject.canonical}`);
-                lines.push(`    alias: ${registryProject.alias ?? "(none)"}`);
-                lines.push(`    initStatus: ${registryProject.initStatus ?? "(none)"}`);
-                lines.push(`    initUpdatedAt: ${registryProject.initUpdatedAt ?? "(none)"}`);
-                if (registryProject.localPaths &&
-                    registryProject.localPaths.length > 0) {
-                    lines.push(`    localPaths: ${registryProject.localPaths.length} path(s)`);
-                }
-            }
-            else {
-                lines.push("  project: not found");
-            }
-            lines.push("");
-            lines.push("Recommended");
-            if (recommendsResume) {
-                lines.push("  dvb init --resume");
-            }
-            else if (recommendsInit) {
-                lines.push("  dvb init");
-            }
-            else if (recommendsForce) {
-                lines.push("  Resume is not available from this clone (no init checkpoint).");
-                lines.push("  If init was started elsewhere, re-run `dvb init --resume` from that repo.");
-                lines.push("  Otherwise, restart init with `dvb init --force` (destroys and recreates the existing devbox).");
-            }
-            else {
-                lines.push("  (none)");
-            }
-            lines.push("");
-            if (parsed.json) {
-                console.log(JSON.stringify({
-                    ok: true,
-                    repo: {
-                        root: repoRoot,
-                        origin: normalizedOrigin ?? origin ?? null,
-                        fingerprint,
-                    },
-                    local: {
-                        marker: repoMarker ?? null,
-                        initState: initState ?? null,
-                        initFingerprintMismatch,
-                        inferredStatus: localStatus,
-                    },
-                    registry: {
-                        socketPath: socketInfo.socketPath,
-                        error: daemonError,
-                        project: registryProject,
-                    },
-                    recommended: recommendsResume
-                        ? "dvb init --resume"
-                        : recommendsInit
-                            ? "dvb init"
-                            : recommendsForce
-                                ? "dvb init --force"
-                                : null,
-                }, null, 2));
-                return;
-            }
-            console.log(lines.join("\n"));
+        if (await runInitStatusFlow({
+            parsed,
+            repoRoot,
+            origin,
+            normalizedOrigin,
+            projectId,
+            projectDir,
+            fingerprint,
+            repoMarker,
+            initState,
+            initFingerprintMismatch,
+            requireDaemonJsonOk,
+            resolveInitStatus,
+        })) {
             return;
         }
-        if (parsed.resume) {
-            if (initFingerprintMismatch) {
-                throw new Error(`Init state does not match this repo. Remove ${path.join(projectDir, "init-state.json")} and run \`dvb init\` again.`);
-            }
-            if (!initState) {
-                throw new Error("No init state to resume. Run `dvb init` to start a new init.");
-            }
-            if (initState.complete) {
-                throw new Error("Init already completed. Run `dvb init` to start a new init.");
-            }
-        }
-        if (initFingerprintMismatch) {
-            initState = null;
-        }
-        const wantsResume = Boolean(parsed.resume);
-        if (!parsed.codexSetupOnly &&
-            !wantsResume &&
-            initState &&
-            !initState.complete &&
-            !parsed.force) {
-            throw new Error("Previous init is incomplete. Run `dvb init --resume` to finish the previous init or `dvb init --force` to restart.");
-        }
-        if (parsed.force && !wantsResume) {
-            // Forced fresh starts must reset checkpoint state so stale `complete`/step
-            // values from prior runs cannot block `dvb init --resume` after failures.
-            const previousState = initState;
-            const freshState = {
-                version: 1,
-                fingerprint,
-                ...(previousState?.canonical !== undefined
-                    ? { canonical: previousState.canonical }
-                    : {}),
-                ...(previousState?.alias !== undefined
-                    ? { alias: previousState.alias }
-                    : {}),
-                ...(previousState?.workdir !== undefined
-                    ? { workdir: previousState.workdir }
-                    : {}),
-                steps: {},
-                updatedAt: new Date().toISOString(),
-                complete: false,
-            };
-            initState = freshState;
-            await writeInitState(projectDir, freshState);
-        }
-        const shouldResume = Boolean(wantsResume && initState && !initState.complete);
-        const ensureInitState = () => {
-            if (!initState || initState.fingerprint !== fingerprint) {
-                initState = {
-                    version: 1,
-                    fingerprint,
-                    steps: {},
-                    updatedAt: new Date().toISOString(),
-                };
-            }
-            return initState;
-        };
-        const updateInitState = async (update) => {
-            const base = ensureInitState();
-            initState = {
-                ...base,
-                ...update,
-                steps: {
-                    ...base.steps,
-                    ...(update.steps ?? {}),
-                },
-                updatedAt: new Date().toISOString(),
-            };
-            await writeInitState(projectDir, initState);
-        };
-        const recordCodexCheckpoint = async ({ client, canonical, phase, }) => {
-            const createdAt = new Date().toISOString();
-            const label = phase === "preCodexSetup" ? "pre-codex-setup" : "post-codex-setup";
-            const comment = `dvb init: ${label} repo=${repoName} fingerprint=${fingerprint} at=${createdAt}`;
-            const events = await client.createCheckpoint(canonical, { comment });
-            const id = extractCheckpointId(events);
-            if (!id) {
+        const preparedSession = await prepareInitSessionState({
+            parsed,
+            initState,
+            initFingerprintMismatch,
+            projectDir,
+            fingerprint,
+        });
+        initState = preparedSession.initState;
+        const { shouldResume, nonInteractive, skipCodexApply, skipCodexCliEnsure } = preparedSession;
+        const getInitState = () => initState;
+        const { updateInitState } = createInitStateUpdater({
+            fingerprint,
+            projectDir,
+            getInitState,
+            setInitState: (next) => {
+                initState = next;
+            },
+        });
+        const recordCodexCheckpoint = createCodexCheckpointRecorder({
+            repoName,
+            fingerprint,
+            getInitState,
+            updateInitState,
+            extractCheckpointId,
+            onCheckpointIdMissing: ({ canonical, phaseLabel }) => {
                 logger.warn("init_checkpoint_id_missing", {
                     box: canonical,
                     fingerprint,
-                    phase: label,
-                });
-                throw new Error("Checkpoint ID missing.");
-            }
-            const record = { id, comment, createdAt };
-            if (initState) {
-                await updateInitState({
-                    checkpoints: { ...(initState.checkpoints ?? {}), [phase]: record },
+                    phase: phaseLabel,
                 });
-            }
-            const metaPath = `/home/sprite/.devbox/projects/${fingerprint}.json`;
-            try {
-                let meta = {};
-                try {
-                    const raw = await client.readFile(canonical, { path: metaPath });
-                    const parsed = JSON.parse(Buffer.from(raw).toString("utf8"));
-                    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-                        meta = parsed;
-                    }
-                }
-                catch (error) {
-                    if (!(error instanceof SpritesApiError && error.status === 404)) {
-                        throw error;
-                    }
-                }
-                const existingCheckpoints = meta.checkpoints &&
-                    typeof meta.checkpoints === "object" &&
-                    !Array.isArray(meta.checkpoints)
-                    ? meta.checkpoints
-                    : {};
-                const updated = {
-                    ...meta,
-                    checkpoints: {
-                        ...existingCheckpoints,
-                        [phase]: record,
-                    },
-                };
-                await client.writeFile(canonical, metaPath, Buffer.from(JSON.stringify(updated, null, 2)));
-            }
-            catch (error) {
+            },
+            onCheckpointMetaUpdateFailed: ({ canonical, phaseLabel, error }) => {
                 logger.warn("init_checkpoint_meta_update_failed", {
                     box: canonical,
                     fingerprint,
-                    phase: label,
-                    error: error instanceof Error ? error.message : String(error),
-                });
-            }
-            return { id, comment, createdAt };
-        };
-        if (parsed.codexSetupOnly) {
-            if (!repoMarker?.canonical) {
-                throw new Error("Repo is not initialized. Run `dvb init` first.");
-            }
-            const setupDir = projectDir;
-            const setupPath = path.join(setupDir, "setup.json");
-            let setupPlan;
-            try {
-                setupPlan = await readSetupPlan(setupPath);
-            }
-            catch {
-                throw new Error(`Missing or invalid setup plan (${setupPath}). Run \`dvb init\` first.`);
-            }
-            const localArtifactsBundlePath = path.join(setupDir, "setup-artifacts.tgz");
-            const localArtifactsManifestPath = path.join(setupDir, "setup-artifacts.json");
-            let artifactsBundlePath = null;
-            let artifactsManifestPath = null;
-            try {
-                await fs.access(localArtifactsBundlePath);
-                await fs.access(localArtifactsManifestPath);
-                artifactsBundlePath = localArtifactsBundlePath;
-                artifactsManifestPath = localArtifactsManifestPath;
-            }
-            catch {
-                // artifacts are optional in setup-only flow
-            }
-            const socketInfo = resolveSocketInfo();
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Starting dvbd",
-                fn: async () => {
-                    await ensureDaemonRunning(socketInfo.socketPath);
-                    await requireDaemonFeatures(socketInfo.socketPath, ["ports"]);
-                },
-            });
-            const { config, client, controlPlaneToken } = await runInitStep({
-                enabled: progressEnabled,
-                title: "Loading devbox config",
-                fn: async () => {
-                    const config = await loadConfig(process.env.HOME ? { homeDir: process.env.HOME } : undefined);
-                    const store = await createSecretStore(config?.tokenStore, process.env.HOME ? { homeDir: process.env.HOME } : undefined);
-                    const apiBaseUrl = resolveSpritesApiUrl(config);
-                    const { token, controlPlaneToken } = await ensureSpritesToken(store, undefined, {
-                        apiBaseUrl,
-                    });
-                    const client = createSpritesClient({
-                        apiBaseUrl,
-                        token,
-                    });
-                    return { config, client, controlPlaneToken };
-                },
-            });
-            const setupOnlyCodexAuthMode = resolveCodexAuthMode(config);
-            const setupOnlyCodexProxyOptions = setupOnlyCodexAuthMode === "proxy"
-                ? {
-                    gatewayBaseUrl: resolveSpritesApiUrl(config),
-                    controlPlaneToken: (controlPlaneToken ?? "").trim(),
-                }
-                : undefined;
-            if (setupOnlyCodexAuthMode === "proxy" &&
-                !setupOnlyCodexProxyOptions?.controlPlaneToken) {
-                throw new Error("Control plane session required for init Codex proxy mode.");
-            }
-            const canonical = repoMarker.canonical;
-            let expandedWorkdir = expandHome(`~/${slug}`);
-            try {
-                const metaRaw = await client.readFile(canonical, {
-                    path: `/home/sprite/.devbox/projects/${fingerprint}.json`,
+                    phase: phaseLabel,
+                    error,
                 });
-                const meta = JSON.parse(Buffer.from(metaRaw).toString("utf8"));
-                if (meta.workdir) {
-                    expandedWorkdir = expandHome(meta.workdir);
-                }
-            }
-            catch {
-                // ignore missing project metadata
-            }
-            const remoteSetupPath = path.posix.join(expandedWorkdir, ".devbox", "setup.json");
-            const remoteArtifactsBundlePath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz");
-            const remoteArtifactsManifestPath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json");
-            const pathSetup = 'export PATH="$(npm bin -g 2>/dev/null):$PATH"';
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Configuring git safe.directory",
-                fn: async ({ status }) => {
-                    await ensureGitSafeDirectory({
-                        client,
-                        canonical,
-                        workdir: expandedWorkdir,
-                        status,
-                    });
-                },
-            });
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Uploading setup plan",
-                fn: async ({ status }) => {
-                    await uploadSetupPlan({
-                        client,
-                        canonical,
-                        localSetupPath: setupPath,
-                        remoteSetupPath,
-                        localArtifactsBundlePath: artifactsBundlePath,
-                        localArtifactsManifestPath: artifactsManifestPath,
-                        remoteArtifactsBundlePath: artifactsBundlePath
-                            ? remoteArtifactsBundlePath
-                            : null,
-                        remoteArtifactsManifestPath: artifactsBundlePath
-                            ? remoteArtifactsManifestPath
-                            : null,
-                        status,
-                    });
-                },
-            });
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Staging setup artifacts",
-                fn: async ({ status }) => {
-                    status.stage("Copying repo artifacts and staging external files");
-                    await stageRemoteSetupArtifacts({
-                        client,
-                        canonical,
-                        workdir: expandedWorkdir,
-                        artifactsBundlePath: remoteArtifactsBundlePath,
-                        artifactsManifestPath: remoteArtifactsManifestPath,
-                    });
-                },
-            });
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Snapshotting filesystem (pre-setup)",
-                fn: async ({ status, fail, ok }) => {
-                    try {
-                        const checkpoint = await retryInitStep({
-                            status,
-                            title: "Snapshotting filesystem (pre-setup)",
-                            fn: async () => await recordCodexCheckpoint({
-                                client,
-                                canonical,
-                                phase: "preCodexSetup",
-                            }),
-                        });
-                        if (checkpoint.id) {
-                            ok(`Snapshot created: ${checkpoint.id}`);
-                        }
-                    }
-                    catch (error) {
-                        logger.warn("init_checkpoint_create_failed", {
-                            box: canonical,
-                            fingerprint,
-                            phase: "pre-codex-setup",
-                            error: error instanceof Error ? error.message : String(error),
-                        });
-                        fail("Snapshotting filesystem (pre-setup) (failed)");
-                        throw error;
-                    }
-                },
-            });
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Enabling devbox services",
-                fn: async ({ status }) => {
-                    await enableRemoteServices({
-                        client,
-                        canonical,
-                        services: setupPlan.services.backgroundServices,
-                        status,
-                    });
-                },
-            });
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Ensuring Codex CLI",
-                fn: async ({ status, fail }) => {
-                    try {
-                        await retryInitStep({
-                            status,
-                            title: "Ensuring Codex CLI",
-                            fn: async () => await ensureRemoteCodexInstalled(client, canonical),
-                        });
-                    }
-                    catch (error) {
-                        logger.warn("codex_cli_ensure_failed", {
-                            box: canonical,
-                            error: error instanceof Error ? error.message : String(error),
-                        });
-                        fail("Ensuring Codex CLI (failed)");
-                        throw error;
-                    }
-                },
-            });
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Applying setup plan",
-                fn: async ({ status }) => {
-                    await runRemoteCodexSetup({
-                        client,
-                        canonical,
-                        expandedWorkdir,
-                        remoteSetupPath,
-                        remoteArtifactsBundlePath,
-                        remoteArtifactsManifestPath,
-                        socketInfo,
-                        status,
-                        pathSetup,
-                        entrypoints: setupPlan.services.appEntrypoints,
-                        emitCodexOutput: !parsed.json,
-                        ...(setupOnlyCodexProxyOptions
-                            ? { proxyOptions: setupOnlyCodexProxyOptions }
-                            : {}),
-                    });
-                },
-            });
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Snapshotting filesystem (post-setup)",
-                fn: async ({ status, fail, ok }) => {
-                    try {
-                        const checkpoint = await retryInitStep({
-                            status,
-                            title: "Snapshotting filesystem (post-setup)",
-                            fn: async () => await recordCodexCheckpoint({
-                                client,
-                                canonical,
-                                phase: "postCodexSetup",
-                            }),
-                        });
-                        if (checkpoint.id) {
-                            ok(`Snapshot created: ${checkpoint.id}`);
-                        }
-                    }
-                    catch (error) {
-                        logger.warn("init_checkpoint_create_failed", {
-                            box: canonical,
-                            fingerprint,
-                            phase: "post-codex-setup",
-                            error: error instanceof Error ? error.message : String(error),
-                        });
-                        fail("Snapshotting filesystem (post-setup) (failed)");
-                        throw error;
-                    }
-                },
-            });
-            if (parsed.json) {
-                console.log(JSON.stringify({ ok: true }, null, 2));
-                return;
-            }
-            console.log("Codex setup complete.");
-            return;
-        }
+            },
+        });
         const socketInfo = resolveSocketInfo();
         await runInitStep({
             enabled: progressEnabled,
@@ -1036,13 +373,15 @@ export const runInit = async (args) => {
                 throw new Error(`Repo already initialized (box: ${existingEntry.canonical}).`);
             }
         }
-        const alias = parsed.alias ?? initState?.alias ?? existingEntry?.alias ?? slug;
-        const canonicalHint = parsed.name ?? initState?.canonical ?? existingEntry?.canonical;
+        const alias = normalizeAlias(parsed.alias ?? initState?.alias ?? existingEntry?.alias ?? slug);
+        validateAlias(alias);
+        const canonicalHint = initState?.canonical ?? existingEntry?.canonical;
         const workdir = `~/${slug}`;
         const expandedWorkdir = expandHome(workdir);
         const remoteSetupPath = path.posix.join(expandedWorkdir, ".devbox", "setup.json");
         const remoteArtifactsBundlePath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz");
         const remoteArtifactsManifestPath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json");
+        const remoteArtifactsPartsDescriptorPath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.parts.json");
         const pathSetup = 'export PATH="$(npm bin -g 2>/dev/null):$PATH"';
         const { config, client, controlPlaneToken } = await runInitStep({
             enabled: progressEnabled,
@@ -1121,15 +460,17 @@ export const runInit = async (args) => {
             });
             existingEntry = null;
         }
-        const username = os.userInfo().username;
         let canonical = (shouldResume && initState?.canonical ? initState.canonical : null) ??
             canonicalHint ??
-            `${username}-${slug}`;
+            alias;
         const knownAssociatedCanonicals = new Set([existingEntry?.canonical, initState?.canonical].filter((value) => typeof value === "string" && value.length > 0));
         const createSprite = async (name) => {
             try {
-                await client.createSprite(name);
-                return "created";
+                const created = await client.createSprite(name);
+                const canonical = typeof created.name === "string" && created.name.trim()
+                    ? created.name.trim()
+                    : name;
+                return { kind: "created", canonical };
             }
             catch (error) {
                 if (error instanceof SpritesApiError) {
@@ -1138,7 +479,7 @@ export const runInit = async (args) => {
                         error.status === 409 ||
                         body.includes("exists") ||
                         body.includes("already")) {
-                        return "exists";
+                        return { kind: "exists" };
                     }
                 }
                 throw error;
@@ -1163,7 +504,7 @@ export const runInit = async (args) => {
                 fn: async ({ status }) => {
                     let nextCanonical = canonical;
                     const createResult = await createSprite(nextCanonical);
-                    if (createResult === "exists") {
+                    if (createResult.kind === "exists") {
                         const associatedCanonical = knownAssociatedCanonicals.has(nextCanonical);
                         if (parsed.force) {
                             if (!associatedCanonical) {
@@ -1181,7 +522,7 @@ export const runInit = async (args) => {
                                     throwInitCanceled();
                                 }
                                 if (!confirmedReuse) {
-                                    throw new Error(`Sprite reuse canceled: ${nextCanonical}. Choose a different --name.`);
+                                    throw new Error(`Sprite reuse canceled: ${nextCanonical}. Choose a different alias.`);
                                 }
                                 status.stage("Creating devbox");
                             }
@@ -1194,11 +535,15 @@ export const runInit = async (args) => {
                             nextCanonical = `${nextCanonical}-${suffix}`;
                             status.stage("Resolving devbox name");
                             const second = await createSprite(nextCanonical);
-                            if (second === "exists") {
+                            if (second.kind === "exists") {
                                 throw new Error(`Sprite already exists: ${nextCanonical}`);
                             }
+                            nextCanonical = second.canonical;
                         }
                     }
+                    else {
+                        nextCanonical = createResult.canonical;
+                    }
                     await updateInitState({
                         canonical: nextCanonical,
                         alias,
@@ -1386,916 +731,6 @@ export const runInit = async (args) => {
                 }
             },
         });
-        const setupDir = projectDir;
-        const setupPath = path.join(setupDir, "setup.json");
-        const scansDir = path.join(setupDir, "scans");
-        const logDir = path.join(setupDir, "logs");
-        const setupEnvSecretsScanPath = path.join(scansDir, "setup-env-secrets.json");
-        const setupExternalScanPath = path.join(scansDir, "setup-external.json");
-        const setupExtraArtifactsScanPath = path.join(scansDir, "setup-extra-artifacts.json");
-        const servicesScanPath = path.join(scansDir, "services.json");
-        let setupArtifacts = null;
-        const nonInteractive = !process.stdin.isTTY || parsed.json;
-        const skipSetupPlan = shouldResume && initState?.steps.setupPlanWritten;
-        const skipServicesConfig = shouldResume && initState?.steps.servicesConfigWritten;
-        const skipServicesEnable = shouldResume && initState?.steps.servicesEnabled;
-        const skipSetupUpload = nonInteractive || (shouldResume && initState?.steps.setupUploaded);
-        const skipCodexApply = nonInteractive || (shouldResume && initState?.steps.codexApplied);
-        const skipCodexCliEnsure = skipCodexApply || (shouldResume && initState?.steps.codexCliEnsured);
-        let approvedPlan = null;
-        const setupTempDir = await fs.mkdtemp(path.join(os.tmpdir(), "devbox-setup-"));
-        try {
-            await fs.mkdir(setupDir, { recursive: true, mode: 0o700 });
-            try {
-                await fs.chmod(setupDir, 0o700);
-            }
-            catch {
-                // best effort on filesystems that do not support chmod
-            }
-            const tryReadSetupPlan = async () => {
-                try {
-                    return await readSetupPlan(setupPath);
-                }
-                catch {
-                    return null;
-                }
-            };
-            const tryReadServicesPlan = async () => {
-                try {
-                    return await readServicesPlan(servicesScanPath);
-                }
-                catch {
-                    return null;
-                }
-            };
-            const tryReadEnvSecretsScan = async () => {
-                try {
-                    return await readSetupEnvSecretsPlan(setupEnvSecretsScanPath);
-                }
-                catch {
-                    return null;
-                }
-            };
-            const tryReadExternalScan = async () => {
-                try {
-                    return await readSetupExternalPlan(setupExternalScanPath);
-                }
-                catch {
-                    return null;
-                }
-            };
-            const tryReadExtraArtifactsScan = async () => {
-                try {
-                    return await readSetupExtraArtifactsPlan(setupExtraArtifactsScanPath);
-                }
-                catch {
-                    return null;
-                }
-            };
-            const shouldRetryCodexScan = (scanFullyCompleted, ...arrays) => !scanFullyCompleted && arrays.every((array) => array.length === 0);
-            let setupPlan = skipSetupPlan || !shouldResume ? null : await tryReadSetupPlan();
-            const needsSetupScan = !skipSetupPlan && !setupPlan;
-            let servicesPlan = !needsSetupScan || !shouldResume ? null : await tryReadServicesPlan();
-            let envSecretsScan = !needsSetupScan || !shouldResume ? null : await tryReadEnvSecretsScan();
-            let externalScan = !needsSetupScan || !shouldResume ? null : await tryReadExternalScan();
-            let extraArtifactsScan = !needsSetupScan || !shouldResume
-                ? null
-                : await tryReadExtraArtifactsScan();
-            if (servicesPlan &&
-                shouldRetryCodexScan(servicesPlan.scanFullyCompleted, servicesPlan.appEntrypoints, servicesPlan.backgroundServices)) {
-                servicesPlan = null;
-            }
-            if (envSecretsScan &&
-                shouldRetryCodexScan(envSecretsScan.scanFullyCompleted, envSecretsScan.envFiles, envSecretsScan.secretFiles)) {
-                envSecretsScan = null;
-            }
-            if (externalScan &&
-                shouldRetryCodexScan(externalScan.scanFullyCompleted, externalScan.externalDependencies, externalScan.externalConfigs)) {
-                externalScan = null;
-            }
-            if (extraArtifactsScan &&
-                shouldRetryCodexScan(extraArtifactsScan.scanFullyCompleted, extraArtifactsScan.extraArtifacts)) {
-                extraArtifactsScan = null;
-            }
-            const needsServicesScan = needsSetupScan && !servicesPlan;
-            const needsEnvSecretsScan = needsSetupScan && !envSecretsScan;
-            const needsExternalScan = needsSetupScan && !externalScan;
-            const needsExtraArtifactsScan = needsSetupScan && !extraArtifactsScan;
-            if (needsSetupScan || needsServicesScan) {
-                const runLocalEnvironmentAnalysis = async ({ updateEnvSecrets, updateExternal, updateExtraArtifacts, updateServices, }) => {
-                    let envSecretsSchemaPath = null;
-                    let externalSchemaPath = null;
-                    let extraArtifactsSchemaPath = null;
-                    let servicesSchemaPath = null;
-                    if (needsEnvSecretsScan) {
-                        envSecretsSchemaPath =
-                            await writeSetupEnvSecretsSchema(setupTempDir);
-                    }
-                    if (needsExternalScan) {
-                        externalSchemaPath = await writeSetupExternalSchema(setupTempDir);
-                    }
-                    if (needsExtraArtifactsScan) {
-                        extraArtifactsSchemaPath =
-                            await writeSetupExtraArtifactsSchema(setupTempDir);
-                    }
-                    if (needsServicesScan) {
-                        servicesSchemaPath = await writeServicesSchema(setupTempDir);
-                    }
-                    if (needsEnvSecretsScan && !envSecretsSchemaPath) {
-                        throw new Error("Env/secrets schema path missing.");
-                    }
-                    if (needsExternalScan && !externalSchemaPath) {
-                        throw new Error("External schema path missing.");
-                    }
-                    if (needsExtraArtifactsScan && !extraArtifactsSchemaPath) {
-                        throw new Error("Extra artifacts schema path missing.");
-                    }
-                    if (needsServicesScan && !servicesSchemaPath) {
-                        throw new Error("Services schema path missing.");
-                    }
-                    if (needsSetupScan) {
-                        await fs.mkdir(scansDir, { recursive: true });
-                    }
-                    const runCodexScanWithImmediateRetry = async ({ run, read, outputPath, update, shouldRetry, }) => {
-                        try {
-                            await run();
-                            let out = await read();
-                            if (shouldRetry(out)) {
-                                update("retrying");
-                                await fs.rm(outputPath, { force: true });
-                                await run();
-                                out = await read();
-                            }
-                            update("done");
-                            return out;
-                        }
-                        catch (error) {
-                            update("failed");
-                            throw error;
-                        }
-                    };
-                    const envSecretsPromise = !needsSetupScan
-                        ? Promise.resolve(null)
-                        : !needsEnvSecretsScan
-                            ? Promise.resolve(envSecretsScan)
-                            : runCodexScanWithImmediateRetry({
-                                run: async () => await runLocalSetupEnvSecretsScan({
-                                    cwd: repoRoot,
-                                    logDir,
-                                    schemaPath: envSecretsSchemaPath,
-                                    outputPath: setupEnvSecretsScanPath,
-                                    ...(initCodexProxyOptions
-                                        ? { proxyOptions: initCodexProxyOptions }
-                                        : {}),
-                                    onProgress: updateEnvSecrets,
-                                }),
-                                read: async () => await readSetupEnvSecretsPlan(setupEnvSecretsScanPath),
-                                outputPath: setupEnvSecretsScanPath,
-                                update: updateEnvSecrets,
-                                shouldRetry: (plan) => shouldRetryCodexScan(plan.scanFullyCompleted, plan.envFiles, plan.secretFiles),
-                            });
-                    const externalPromise = !needsSetupScan
-                        ? Promise.resolve(null)
-                        : !needsExternalScan
-                            ? Promise.resolve(externalScan)
-                            : runCodexScanWithImmediateRetry({
-                                run: async () => await runLocalSetupExternalScan({
-                                    cwd: repoRoot,
-                                    logDir,
-                                    schemaPath: externalSchemaPath,
-                                    outputPath: setupExternalScanPath,
-                                    homeDir: localHomeDir,
-                                    ...(initCodexProxyOptions
-                                        ? { proxyOptions: initCodexProxyOptions }
-                                        : {}),
-                                    onProgress: updateExternal,
-                                }),
-                                read: async () => await readSetupExternalPlan(setupExternalScanPath),
-                                outputPath: setupExternalScanPath,
-                                update: updateExternal,
-                                shouldRetry: (plan) => shouldRetryCodexScan(plan.scanFullyCompleted, plan.externalDependencies, plan.externalConfigs),
-                            });
-                    const extraArtifactsPromise = !needsSetupScan
-                        ? Promise.resolve(null)
-                        : !needsExtraArtifactsScan
-                            ? Promise.resolve(extraArtifactsScan)
-                            : runCodexScanWithImmediateRetry({
-                                run: async () => await runLocalSetupExtraArtifactsScan({
-                                    cwd: repoRoot,
-                                    logDir,
-                                    schemaPath: extraArtifactsSchemaPath,
-                                    outputPath: setupExtraArtifactsScanPath,
-                                    ...(initCodexProxyOptions
-                                        ? { proxyOptions: initCodexProxyOptions }
-                                        : {}),
-                                    onProgress: updateExtraArtifacts,
-                                }),
-                                read: async () => await readSetupExtraArtifactsPlan(setupExtraArtifactsScanPath),
-                                outputPath: setupExtraArtifactsScanPath,
-                                update: updateExtraArtifacts,
-                                shouldRetry: (plan) => shouldRetryCodexScan(plan.scanFullyCompleted, plan.extraArtifacts),
-                            });
-                    const servicesPromise = !needsServicesScan
-                        ? Promise.resolve(servicesPlan)
-                        : runCodexScanWithImmediateRetry({
-                            run: async () => await runLocalServicesScan({
-                                cwd: repoRoot,
-                                logDir,
-                                schemaPath: servicesSchemaPath,
-                                outputPath: servicesScanPath,
-                                homeDir: localHomeDir,
-                                ...(initCodexProxyOptions
-                                    ? { proxyOptions: initCodexProxyOptions }
-                                    : {}),
-                                onProgress: updateServices,
-                            }),
-                            read: async () => await readServicesPlan(servicesScanPath),
-                            outputPath: servicesScanPath,
-                            update: updateServices,
-                            shouldRetry: (plan) => shouldRetryCodexScan(plan.scanFullyCompleted, plan.appEntrypoints, plan.backgroundServices),
-                        });
-                    const [envSecrets, external, extraArtifacts, services] = await Promise.all([
-                        envSecretsPromise,
-                        externalPromise,
-                        extraArtifactsPromise,
-                        servicesPromise,
-                    ]);
-                    if (needsServicesScan) {
-                        if (!services) {
-                            throw new Error("Services scan missing.");
-                        }
-                        servicesPlan = services;
-                    }
-                    if (needsSetupScan) {
-                        if (!envSecrets) {
-                            throw new Error("Env/secrets scan missing.");
-                        }
-                        if (!external) {
-                            throw new Error("External scan missing.");
-                        }
-                        if (!extraArtifacts) {
-                            throw new Error("Extra artifacts scan missing.");
-                        }
-                        if (!servicesPlan) {
-                            throw new Error("Services scan missing.");
-                        }
-                        updateEnvSecrets("merging setup plan");
-                        const merged = mergeSetupScans({
-                            envSecrets,
-                            external,
-                            extraArtifacts,
-                            services: {
-                                appEntrypoints: servicesPlan.appEntrypoints,
-                                backgroundServices: servicesPlan.backgroundServices,
-                            },
-                        });
-                        await writeSetupPlan(setupPath, merged);
-                        setupPlan = merged;
-                    }
-                };
-                if (!progressEnabled) {
-                    await runLocalEnvironmentAnalysis({
-                        updateEnvSecrets: () => { },
-                        updateExternal: () => { },
-                        updateExtraArtifacts: () => { },
-                        updateServices: () => { },
-                    });
-                }
-                else {
-                    const log = clackTaskLog({
-                        title: "Analyzing local environment",
-                        limit: 1,
-                        spacing: 0,
-                    });
-                    let active = true;
-                    const colorCategory = (label) => {
-                        if (!process.stdout.hasColors?.())
-                            return label;
-                        const undim = "\u001b[22m";
-                        const dim = "\u001b[2m";
-                        const bold = "\u001b[1m";
-                        const teal = "\u001b[36m";
-                        const resetColor = "\u001b[39m";
-                        return `${undim}${teal}${bold}${label}${resetColor}${undim}${dim}`;
-                    };
-                    const formatRow = (label, message) => {
-                        const normalized = message.replace(/\r?\n/g, " ").trim();
-                        return `${colorCategory(label)}: ${normalized}`;
-                    };
-                    const envSecretsRow = log.group("");
-                    const externalRow = log.group("");
-                    const extraArtifactsRow = log.group("");
-                    const servicesRow = log.group("");
-                    const makeUpdater = (row, label) => (message) => {
-                        if (!active)
-                            return;
-                        row.message(formatRow(label, message));
-                    };
-                    const updateEnvSecrets = makeUpdater(envSecretsRow, "env/secrets");
-                    const updateExternal = makeUpdater(externalRow, "external");
-                    const updateExtraArtifacts = makeUpdater(extraArtifactsRow, "extra artifacts");
-                    const updateServices = makeUpdater(servicesRow, "services");
-                    updateEnvSecrets(needsSetupScan
-                        ? needsEnvSecretsScan
-                            ? "starting"
-                            : "cached"
-                        : "skipped");
-                    updateExternal(needsSetupScan
-                        ? needsExternalScan
-                            ? "starting"
-                            : "cached"
-                        : "skipped");
-                    updateExtraArtifacts(needsSetupScan
-                        ? needsExtraArtifactsScan
-                            ? "starting"
-                            : "cached"
-                        : "skipped");
-                    updateServices(needsServicesScan ? "starting" : "cached");
-                    try {
-                        await runLocalEnvironmentAnalysis({
-                            updateEnvSecrets,
-                            updateExternal,
-                            updateExtraArtifacts,
-                            updateServices,
-                        });
-                        active = false;
-                        log.success("Analyzing local environment");
-                    }
-                    catch (error) {
-                        active = false;
-                        log.error("Analyzing local environment");
-                        throw error;
-                    }
-                }
-            }
-            if (!skipSetupPlan && !setupPlan) {
-                setupPlan = await readSetupPlan(setupPath);
-            }
-            if (!skipSetupPlan && !setupPlan) {
-                throw new Error("Setup plan missing.");
-            }
-            const scanStepUpdate = {};
-            if (!skipSetupPlan && setupPlan) {
-                if (!initState?.steps.setupEnvSecretsScanned) {
-                    scanStepUpdate.setupEnvSecretsScanned = true;
-                }
-                if (!initState?.steps.setupExternalScanned) {
-                    scanStepUpdate.setupExternalScanned = true;
-                }
-                if (!initState?.steps.setupExtraArtifactsScanned) {
-                    scanStepUpdate.setupExtraArtifactsScanned = true;
-                }
-                if (!initState?.steps.setupPlanScanned) {
-                    scanStepUpdate.setupPlanScanned = true;
-                }
-                if (!initState?.steps.servicesPlanScanned) {
-                    scanStepUpdate.servicesPlanScanned = true;
-                }
-            }
-            if (Object.keys(scanStepUpdate).length > 0) {
-                await updateInitState({ steps: scanStepUpdate });
-            }
-            if (skipSetupPlan) {
-                approvedPlan = await readSetupPlan(setupPath);
-            }
-            if (shouldResume && approvedPlan) {
-                const backfillStepUpdate = {};
-                if (!initState?.steps.setupEnvSecretsScanned) {
-                    backfillStepUpdate.setupEnvSecretsScanned = true;
-                }
-                if (!initState?.steps.setupExternalScanned) {
-                    backfillStepUpdate.setupExternalScanned = true;
-                }
-                if (!initState?.steps.setupExtraArtifactsScanned) {
-                    backfillStepUpdate.setupExtraArtifactsScanned = true;
-                }
-                if (!initState?.steps.setupPlanScanned) {
-                    backfillStepUpdate.setupPlanScanned = true;
-                }
-                if (!initState?.steps.servicesPlanScanned) {
-                    backfillStepUpdate.servicesPlanScanned = true;
-                }
-                if (Object.keys(backfillStepUpdate).length > 0) {
-                    await updateInitState({ steps: backfillStepUpdate });
-                }
-            }
-            if (nonInteractive) {
-                if (setupPlan)
-                    approvedPlan = setupPlan;
-            }
-            else if (!skipSetupPlan && setupPlan) {
-                if (!process.stdin.isTTY || parsed.json) {
-                    throw new Error("Interactive terminal required to approve setup.");
-                }
-                const statCache = new Map();
-                const readPathInfo = async (candidatePath) => {
-                    const cached = statCache.get(candidatePath);
-                    if (cached)
-                        return cached;
-                    const resolved = path.isAbsolute(candidatePath)
-                        ? candidatePath
-                        : path.resolve(repoRoot, candidatePath);
-                    const relative = toRepoRelativePath(repoRoot, candidatePath);
-                    const outsideRepo = isOutsideRepoPath(relative);
-                    let isDirectory = false;
-                    try {
-                        const stat = await fs.stat(resolved);
-                        isDirectory = stat.isDirectory();
-                    }
-                    catch {
-                        isDirectory = false;
-                    }
-                    const info = { relative, outsideRepo, isDirectory };
-                    statCache.set(candidatePath, info);
-                    return info;
-                };
-                const buildApprovalSummary = async (plan) => {
-                    const lines = [];
-                    lines.push("Setup");
-                    lines.push(`- .env files: ${plan.envFiles.length}`);
-                    for (const entry of plan.envFiles) {
-                        lines.push(`  - ${toRepoRelativePath(repoRoot, entry.path)}`);
-                    }
-                    lines.push(`- Secret/config files: ${plan.secretFiles.length}`);
-                    for (const entry of plan.secretFiles) {
-                        lines.push(`  - ${toRepoRelativePath(repoRoot, entry.path)}`);
-                    }
-                    lines.push(`- Other artifacts: ${plan.extraArtifacts.length}`);
-                    for (const entry of plan.extraArtifacts) {
-                        lines.push(`  - ${toRepoRelativePath(repoRoot, entry.path)}`);
-                    }
-                    lines.push(`- External dependencies: ${plan.externalDependencies.length}`);
-                    for (const entry of plan.externalDependencies) {
-                        lines.push(`  - ${entry.version ? `${entry.name}@${entry.version}` : entry.name}`);
-                    }
-                    lines.push(`- External config/secret files: ${plan.externalConfigs.length}`);
-                    for (const entry of plan.externalConfigs) {
-                        lines.push(`  - ${toRepoRelativePath(repoRoot, entry.path)}`);
-                    }
-                    lines.push("");
-                    lines.push("Services");
-                    lines.push(`- App entrypoints: ${plan.services.appEntrypoints.length}`);
-                    for (const entry of plan.services.appEntrypoints) {
-                        lines.push(`  - ${entry.command}`);
-                    }
-                    lines.push(`- Background services: ${plan.services.backgroundServices.length}`);
-                    for (const entry of plan.services.backgroundServices) {
-                        lines.push(`  - ${entry.name}`);
-                    }
-                    const candidatePaths = new Set();
-                    for (const entry of [
-                        ...plan.envFiles,
-                        ...plan.secretFiles,
-                        ...plan.extraArtifacts,
-                        ...plan.externalConfigs,
-                    ]) {
-                        candidatePaths.add(entry.path);
-                    }
-                    const outsideRepoPaths = [];
-                    const directoryPaths = [];
-                    for (const candidatePath of candidatePaths) {
-                        const info = await readPathInfo(candidatePath);
-                        if (info.outsideRepo)
-                            outsideRepoPaths.push(info.relative);
-                        if (info.isDirectory)
-                            directoryPaths.push(info.relative);
-                    }
-                    outsideRepoPaths.sort();
-                    directoryPaths.sort();
-                    const hasRisk = outsideRepoPaths.length > 0 || directoryPaths.length > 0;
-                    const warningLines = [];
-                    if (outsideRepoPaths.length > 0) {
-                        warningLines.push("Outside repo:");
-                        for (const entry of outsideRepoPaths) {
-                            warningLines.push(`- ${entry}`);
-                        }
-                        warningLines.push("");
-                    }
-                    if (directoryPaths.length > 0) {
-                        warningLines.push("Directories:");
-                        for (const entry of directoryPaths) {
-                            warningLines.push(`- ${entry}`);
-                        }
-                    }
-                    return {
-                        summary: lines.join("\n"),
-                        warning: warningLines.length > 0 ? warningLines.join("\n") : null,
-                        hasRisk,
-                    };
-                };
-                let draftSetup = setupPlan;
-                while (true) {
-                    const nextSetup = await promptForPlanApproval({
-                        plan: setupPlan,
-                        repoRoot,
-                        initialPlan: draftSetup,
-                    });
-                    const nextServices = await promptForServicesApproval({
-                        plan: setupPlan.services,
-                        initialSelection: draftSetup?.services ?? null,
-                    });
-                    const nextPlan = { ...nextSetup, services: nextServices };
-                    const { summary, warning, hasRisk } = await buildApprovalSummary(nextPlan);
-                    clackNote(summary, "Selected setup requirements");
-                    if (warning) {
-                        clackNote(warning, "Special attention");
-                    }
-                    const decision = await clackSelect({
-                        message: "Proceed with these selections?",
-                        options: [
-                            { value: "proceed", label: "Proceed" },
-                            { value: "edit", label: "Edit selections" },
-                            { value: "cancel", label: "Cancel" },
-                        ],
-                        initialValue: "proceed",
-                    });
-                    if (isCancel(decision) || decision === "cancel") {
-                        throwInitCanceled();
-                    }
-                    if (decision === "edit") {
-                        draftSetup = nextPlan;
-                        continue;
-                    }
-                    if (hasRisk) {
-                        const confirmed = await clackConfirm({
-                            message: "You selected items outside the repo and/or directories. Continue?",
-                            active: "Continue",
-                            inactive: "Edit selections",
-                            initialValue: true,
-                        });
-                        if (isCancel(confirmed)) {
-                            throwInitCanceled();
-                        }
-                        if (!confirmed) {
-                            draftSetup = nextPlan;
-                            continue;
-                        }
-                    }
-                    approvedPlan = nextPlan;
-                    break;
-                }
-            }
-            if (!approvedPlan) {
-                throw new Error("Setup plan missing.");
-            }
-            const ensuredPlan = approvedPlan;
-            if (!skipSetupPlan) {
-                await writeSetupPlan(setupPath, ensuredPlan);
-                await updateInitState({ steps: { setupPlanWritten: true } });
-            }
-            if (!skipSetupUpload) {
-                setupArtifacts = await runInitStep({
-                    enabled: progressEnabled,
-                    title: "Packaging setup artifacts",
-                    fn: async () => await createSetupArtifacts({
-                        repoRoot,
-                        plan: ensuredPlan,
-                        outputDir: setupDir,
-                        tempDir: setupTempDir,
-                        homeDir: localHomeDir,
-                    }),
-                });
-            }
-        }
-        finally {
-            await fs.rm(setupTempDir, { recursive: true, force: true });
-        }
-        if (!approvedPlan) {
-            throw new Error("Setup plan missing.");
-        }
-        const skipProvision = shouldResume && initState?.steps.workdirProvisioned;
-        if (skipProvision && !skipSetupUpload) {
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Uploading setup plan",
-                fn: async ({ status }) => {
-                    await uploadSetupPlan({
-                        client,
-                        canonical,
-                        localSetupPath: setupPath,
-                        remoteSetupPath,
-                        localArtifactsBundlePath: setupArtifacts?.bundlePath ?? null,
-                        localArtifactsManifestPath: setupArtifacts?.manifestPath ?? null,
-                        remoteArtifactsBundlePath: setupArtifacts
-                            ? path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz")
-                            : null,
-                        remoteArtifactsManifestPath: setupArtifacts
-                            ? path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json")
-                            : null,
-                        status,
-                    });
-                },
-            });
-            await updateInitState({ steps: { setupUploaded: true } });
-            await updateRegistryProjectStatus(resolveInitStatus(initState?.steps, initState?.complete));
-        }
-        else if (!skipProvision || !skipSetupUpload) {
-            const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "devbox-init-"));
-            const bundlePath = path.join(tempDir, "repo.bundle");
-            const gitMetaPath = path.join(tempDir, "git-meta.tgz");
-            const gitMetaListPath = path.join(tempDir, "git-meta.list");
-            const stagedPatchPath = path.join(tempDir, "staged.patch");
-            const unstagedPatchPath = path.join(tempDir, "unstaged.patch");
-            const untrackedPath = path.join(tempDir, "untracked.tgz");
-            const untrackedListPath = path.join(tempDir, "untracked.list");
-            const globalGitConfigSources = await readGlobalGitConfigFiles(repoRoot);
-            const globalGitConfigMappings = mapGlobalGitConfigDestinations(globalGitConfigSources, localHomeDir);
-            try {
-                const remoteBundlePath = "/home/sprite/.devbox/upload.bundle";
-                const remoteGitMetaPath = "/home/sprite/.devbox/git-meta.tgz";
-                const remoteStagedPatchPath = "/home/sprite/.devbox/staged.patch";
-                const remoteUnstagedPatchPath = "/home/sprite/.devbox/unstaged.patch";
-                const remoteUntrackedPath = "/home/sprite/.devbox/untracked.tgz";
-                await runInitStep({
-                    enabled: progressEnabled,
-                    title: "Preparing remote directories",
-                    fn: async ({ status }) => {
-                        status.stage("Checking remote git");
-                        const gitCheck = await client.exec(canonical, [
-                            "/bin/bash",
-                            "-lc",
-                            "git --version",
-                        ]);
-                        if (gitCheck.exitCode !== 0) {
-                            const details = gitCheck.stderr || gitCheck.stdout || "";
-                            throw new Error(details
-                                ? `Remote git unavailable: ${details.trim()}`
-                                : "Remote git unavailable");
-                        }
-                        const remoteDirs = new Set();
-                        remoteDirs.add(path.posix.dirname(remoteBundlePath));
-                        remoteDirs.add(path.posix.dirname(remoteGitMetaPath));
-                        remoteDirs.add(path.posix.dirname(remoteStagedPatchPath));
-                        remoteDirs.add(path.posix.dirname(remoteUnstagedPatchPath));
-                        remoteDirs.add(path.posix.dirname(remoteUntrackedPath));
-                        for (const mapping of globalGitConfigMappings) {
-                            remoteDirs.add(path.posix.dirname(mapping.dest));
-                        }
-                        if (remoteDirs.size > 0) {
-                            status.stage("Preparing remote directories");
-                            const prepResult = await client.exec(canonical, [
-                                "/bin/bash",
-                                "-lc",
-                                `mkdir -p ${[...remoteDirs].map(shellQuote).join(" ")}`,
-                            ]);
-                            if (prepResult.exitCode !== 0) {
-                                throw new Error(prepResult.stderr || "Failed to prepare remote dirs");
-                            }
-                        }
-                    },
-                });
-                const { headState, gitCommonDir, worktreeState, copyWorktree } = await runInitStep({
-                    enabled: progressEnabled,
-                    title: "Inspecting repo state",
-                    fn: async ({ status }) => {
-                        const headState = await readHeadState(repoRoot);
-                        const resolved = await resolveGitCommonDir(repoRoot);
-                        const worktreeState = await readWorktreeState(repoRoot);
-                        const hasWorktreeChanges = worktreeState.staged.length > 0 ||
-                            worktreeState.unstaged.length > 0 ||
-                            worktreeState.untracked.length > 0;
-                        let copyWorktree = false;
-                        if (hasWorktreeChanges && process.stdin.isTTY && !parsed.json) {
-                            status.stop();
-                            copyWorktree = await confirmCopyWorktree(worktreeState);
-                            status.stage("Inspecting repo state");
-                        }
-                        else if (hasWorktreeChanges) {
-                            copyWorktree = true;
-                        }
-                        return {
-                            headState,
-                            gitCommonDir: resolved.commonDir,
-                            worktreeState,
-                            copyWorktree,
-                        };
-                    },
-                });
-                const packaged = await runInitStep({
-                    enabled: progressEnabled,
-                    title: "Packaging repo",
-                    fn: async ({ status }) => {
-                        let gitMetaCreated = false;
-                        let stagedPatchCreated = false;
-                        let unstagedPatchCreated = false;
-                        let untrackedCreated = false;
-                        status.stage("Packaging repo bundle");
-                        await runCommand(repoRoot, "git", [
-                            "bundle",
-                            "create",
-                            bundlePath,
-                            "--all",
-                        ]);
-                        status.stage("Packaging git metadata");
-                        gitMetaCreated = await createGitMetaArchive(gitCommonDir, gitMetaPath, gitMetaListPath);
-                        if (copyWorktree) {
-                            status.stage("Packaging repo changes");
-                            stagedPatchCreated = await writePatch(repoRoot, ["diff", "--binary", "--cached"], stagedPatchPath);
-                            unstagedPatchCreated = await writePatch(repoRoot, ["diff", "--binary"], unstagedPatchPath);
-                            untrackedCreated = await createFileListArchive(repoRoot, worktreeState.untracked, untrackedPath, untrackedListPath);
-                        }
-                        return {
-                            gitMetaCreated,
-                            stagedPatchCreated,
-                            unstagedPatchCreated,
-                            untrackedCreated,
-                        };
-                    },
-                });
-                await runInitStep({
-                    enabled: progressEnabled,
-                    title: "Uploading repo",
-                    fn: async ({ status }) => {
-                        const uploadItems = [
-                            {
-                                label: "repo bundle",
-                                localPath: bundlePath,
-                                remotePath: remoteBundlePath,
-                            },
-                        ];
-                        if (packaged.gitMetaCreated) {
-                            uploadItems.push({
-                                label: "git metadata",
-                                localPath: gitMetaPath,
-                                remotePath: remoteGitMetaPath,
-                            });
-                        }
-                        if (packaged.stagedPatchCreated) {
-                            uploadItems.push({
-                                label: "staged changes",
-                                localPath: stagedPatchPath,
-                                remotePath: remoteStagedPatchPath,
-                            });
-                        }
-                        if (packaged.unstagedPatchCreated) {
-                            uploadItems.push({
-                                label: "unstaged changes",
-                                localPath: unstagedPatchPath,
-                                remotePath: remoteUnstagedPatchPath,
-                            });
-                        }
-                        if (packaged.untrackedCreated) {
-                            uploadItems.push({
-                                label: "untracked files",
-                                localPath: untrackedPath,
-                                remotePath: remoteUntrackedPath,
-                            });
-                        }
-                        for (const mapping of globalGitConfigMappings) {
-                            uploadItems.push({
-                                label: `git config (${path.basename(mapping.source)})`,
-                                localPath: mapping.source,
-                                remotePath: mapping.dest,
-                            });
-                        }
-                        const plannedUploads = await Promise.all(uploadItems.map(async (item) => {
-                            const stats = await fs.stat(item.localPath);
-                            return { ...item, size: stats.size };
-                        }));
-                        const totalBytes = plannedUploads.reduce((sum, item) => sum + item.size, 0);
-                        let uploadedBytes = 0;
-                        const updateProgress = (currentFileBytes, detail) => status.byteProgress({
-                            title: "Uploading repo",
-                            uploadedBytes: uploadedBytes + currentFileBytes,
-                            totalBytes,
-                            detail,
-                        });
-                        for (const [index, upload] of plannedUploads.entries()) {
-                            const detail = `${upload.label} (${index + 1}/${plannedUploads.length})`;
-                            const fileData = await fs.readFile(upload.localPath);
-                            updateProgress(0, detail);
-                            await client.writeFile(canonical, upload.remotePath, fileData, {
-                                onProgress: (fileUploadedBytes, fileTotalBytes) => {
-                                    const bounded = Math.min(fileUploadedBytes, Math.max(fileData.length, fileTotalBytes));
-                                    updateProgress(bounded, detail);
-                                },
-                            });
-                            uploadedBytes += fileData.length;
-                            updateProgress(fileData.length, detail);
-                        }
-                        status.byteProgress({
-                            title: "Uploading repo",
-                            uploadedBytes: totalBytes,
-                            totalBytes,
-                            detail: "completed",
-                        });
-                    },
-                });
-                await runInitStep({
-                    enabled: progressEnabled,
-                    title: "Provisioning workdir",
-                    fn: async () => {
-                        const backup = `${expandedWorkdir}.bak-${Date.now()}`;
-                        const checkoutCommand = headState.branch
-                            ? `git checkout -B ${shellQuote(headState.branch)} ${shellQuote(headState.commit)}`
-                            : `git checkout --detach ${shellQuote(headState.commit)}`;
-                        const remoteCommand = [
-                            "set -euo pipefail",
-                            "unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE",
-                            `if [ -d ${shellQuote(expandedWorkdir)} ]; then`,
-                            parsed.force
-                                ? `  mv ${shellQuote(expandedWorkdir)} ${shellQuote(backup)}`
-                                : `  echo "Target exists: ${expandedWorkdir}" >&2; exit 1`,
-                            "fi",
-                            `mkdir -p ${shellQuote(path.dirname(expandedWorkdir))}`,
-                            `git init -b devbox-init ${shellQuote(expandedWorkdir)}`,
-                            `cd ${shellQuote(expandedWorkdir)}`,
-                            `git fetch ${shellQuote(remoteBundlePath)} 'refs/*:refs/*'`,
-                            `if [ -f ${shellQuote(remoteGitMetaPath)} ]; then`,
-                            `  tar -xzf ${shellQuote(remoteGitMetaPath)} -C .git`,
-                            "fi",
-                            checkoutCommand,
-                            `if [ -f ${shellQuote(remoteStagedPatchPath)} ]; then`,
-                            `  git apply --index ${shellQuote(remoteStagedPatchPath)}`,
-                            "fi",
-                            `if [ -f ${shellQuote(remoteUnstagedPatchPath)} ]; then`,
-                            `  git apply ${shellQuote(remoteUnstagedPatchPath)}`,
-                            "fi",
-                            `if [ -f ${shellQuote(remoteUntrackedPath)} ]; then`,
-                            `  tar -xzf ${shellQuote(remoteUntrackedPath)} -C .`,
-                            "fi",
-                        ].join("\n");
-                        const execResult = await client.exec(canonical, [
-                            "/bin/bash",
-                            "--noprofile",
-                            "--norc",
-                            "-e",
-                            "-u",
-                            "-o",
-                            "pipefail",
-                            "-c",
-                            remoteCommand,
-                        ]);
-                        if (execResult.exitCode !== 0) {
-                            throw new Error(execResult.stderr || "Remote init failed");
-                        }
-                        await updateInitState({ steps: { workdirProvisioned: true } });
-                    },
-                });
-                if (!skipSetupUpload) {
-                    await runInitStep({
-                        enabled: progressEnabled,
-                        title: "Uploading setup plan",
-                        fn: async ({ status }) => {
-                            await uploadSetupPlan({
-                                client,
-                                canonical,
-                                localSetupPath: setupPath,
-                                remoteSetupPath,
-                                localArtifactsBundlePath: setupArtifacts?.bundlePath ?? null,
-                                localArtifactsManifestPath: setupArtifacts?.manifestPath ?? null,
-                                remoteArtifactsBundlePath: setupArtifacts
-                                    ? path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz")
-                                    : null,
-                                remoteArtifactsManifestPath: setupArtifacts
-                                    ? path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json")
-                                    : null,
-                                status,
-                            });
-                        },
-                    });
-                    await updateInitState({ steps: { setupUploaded: true } });
-                    await updateRegistryProjectStatus(resolveInitStatus(initState?.steps, initState?.complete));
-                }
-            }
-            finally {
-                await fs.rm(tempDir, { recursive: true, force: true });
-            }
-        }
-        await runInitStep({
-            enabled: progressEnabled,
-            title: "Ensuring workdir ownership",
-            fn: async ({ status }) => {
-                await retryInitStep({
-                    status,
-                    title: "Ensuring workdir ownership",
-                    fn: async () => await ensureWorkdirOwnership({
-                        client,
-                        canonical,
-                        workdir: expandedWorkdir,
-                        status,
-                    }),
-                });
-            },
-        });
-        const skipGitSafeDirectory = shouldResume && initState?.steps.gitSafeDirectoryConfigured;
-        if (!skipGitSafeDirectory) {
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Configuring git safe.directory",
-                fn: async ({ status }) => {
-                    await ensureGitSafeDirectory({
-                        client,
-                        canonical,
-                        workdir: expandedWorkdir,
-                        status,
-                    });
-                    await updateInitState({
-                        steps: { gitSafeDirectoryConfigured: true },
-                    });
-                },
-            });
-        }
         const skipSshdConfig = shouldResume && initState?.steps.sshdConfigured;
         if (!skipSshdConfig) {
             await runInitStep({
@@ -2342,143 +777,6 @@ export const runInit = async (args) => {
                 },
             });
         }
-        const skipSshAuth = nonInteractive || (shouldResume && initState?.steps.sshAuthConfigured);
-        if (!skipSshAuth) {
-            const { remoteOrigin, remoteInfo } = await runInitStep({
-                enabled: progressEnabled,
-                title: "Checking git remote for SSH auth",
-                fn: async () => {
-                    const remoteOrigin = await readRemoteOrigin(client, canonical, expandedWorkdir);
-                    const remoteInfo = remoteOrigin ? parseGitRemote(remoteOrigin) : null;
-                    return { remoteOrigin, remoteInfo };
-                },
-            });
-            if (!remoteOrigin) {
-                if (!parsed.json) {
-                    console.warn("Warning: unable to detect remote origin on sprite. Skipping SSH setup.");
-                }
-            }
-            else if (!remoteInfo) {
-                if (!parsed.json) {
-                    console.warn(`Warning: unrecognized git remote format (${remoteOrigin}). Skipping SSH setup.`);
-                }
-            }
-            else {
-                let activeOrigin = remoteOrigin;
-                if (remoteInfo.protocol === "https") {
-                    if (!parsed.json) {
-                        clackNote([
-                            `Origin is HTTPS (${remoteOrigin}).`,
-                            "",
-                            "This only changes the remote devbox checkout (your local checkout is unchanged).",
-                            "SSH key auth on the remote devbox will not work unless this remote uses SSH:",
-                            remoteInfo.sshUrl,
-                        ].join("\n"), "Git remote");
-                    }
-                    const shouldSwitch = await clackSelect({
-                        message: `Use SSH auth for ${remoteInfo.host} on the remote devbox checkout?`,
-                        options: [
-                            {
-                                value: "switch",
-                                label: "Use SSH on remote devbox (Recommended)",
-                            },
-                            { value: "keep", label: "Keep HTTPS (Skip SSH auth setup)" },
-                            { value: "cancel", label: "Cancel init" },
-                        ],
-                        initialValue: "switch",
-                    });
-                    if (isCancel(shouldSwitch) || shouldSwitch === "cancel") {
-                        throwInitCanceled();
-                    }
-                    if (shouldSwitch === "keep") {
-                        if (!parsed.json) {
-                            console.warn("Skipping SSH auth setup. Configure git credentials for this repo manually before pulling or pushing.");
-                        }
-                        await updateInitState({
-                            steps: { sshAuthConfigured: true },
-                        });
-                        activeOrigin = "";
-                    }
-                    else {
-                        await runInitStep({
-                            enabled: progressEnabled,
-                            title: "Updating remote devbox checkout to SSH git remote",
-                            fn: async () => {
-                                await setRemoteOrigin(client, canonical, expandedWorkdir, remoteInfo.sshUrl);
-                            },
-                        });
-                        activeOrigin = remoteInfo.sshUrl;
-                    }
-                }
-                if (activeOrigin) {
-                    const publicKey = await runInitStep({
-                        enabled: progressEnabled,
-                        title: "Generating SSH key",
-                        fn: async () => await ensureSshKey(client, canonical, `${alias}@devbox`),
-                    });
-                    await runInitStep({
-                        enabled: progressEnabled,
-                        title: "Updating SSH config",
-                        fn: async () => await ensureSshConfig(client, canonical, remoteInfo.host),
-                    });
-                    if (!parsed.json) {
-                        clackNote(publicKey, `Add this SSH public key to ${remoteInfo.host}`);
-                        const copied = await copyToClipboard(publicKey);
-                        if (copied) {
-                            clackLog.success("Copied SSH public key to clipboard.");
-                        }
-                        else {
-                            clackLog.warn("Could not copy the SSH key automatically.");
-                        }
-                        const shouldOpen = await promptBeforeOpenBrowser({
-                            url: remoteInfo.settingsUrl,
-                            title: `${remoteInfo.host} SSH key page`,
-                            consequence: [
-                                "Skipping browser open.",
-                                "You must add the SSH key before git pull/push will work via SSH.",
-                            ].join(" "),
-                        });
-                        if (shouldOpen) {
-                            const opened = openBrowser(remoteInfo.settingsUrl);
-                            if (!opened) {
-                                clackLog.warn("Unable to open the browser automatically.");
-                            }
-                        }
-                    }
-                    const added = await clackConfirm({
-                        message: "Have you added the SSH key?",
-                        active: "Yes, verify now",
-                        inactive: "Not yet",
-                        initialValue: true,
-                    });
-                    if (isCancel(added)) {
-                        throwInitCanceled();
-                    }
-                    if (!added) {
-                        if (!parsed.json) {
-                            console.warn("Skipping SSH verification. Add the key and re-run `dvb init --resume` to verify.");
-                        }
-                    }
-                    else {
-                        const verified = await runInitStep({
-                            enabled: progressEnabled,
-                            title: "Verifying git SSH auth",
-                            fn: async () => await verifySshAuth(client, canonical, remoteInfo.host, expandedWorkdir),
-                        });
-                        if (!verified) {
-                            if (!parsed.json) {
-                                console.warn("SSH auth verification failed. Confirm the key is added and that the repo access is granted.");
-                            }
-                        }
-                        else {
-                            await updateInitState({
-                                steps: { sshAuthConfigured: true },
-                            });
-                        }
-                    }
-                }
-            }
-        }
         const weztermMuxPresent = await runInitStep({
             enabled: progressEnabled,
             title: "Ensuring WezTerm mux server (optional)",
@@ -2557,88 +855,6 @@ export const runInit = async (args) => {
                 },
             });
         }
-        if (!skipServicesConfig) {
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Writing devbox.toml services",
-                fn: async () => {
-                    await writeRemoteServicesToml({
-                        client,
-                        canonical,
-                        workdir: expandedWorkdir,
-                        services: approvedPlan.services.backgroundServices,
-                    });
-                    await updateInitState({ steps: { servicesConfigWritten: true } });
-                },
-            });
-        }
-        const projectMeta = {
-            fingerprint,
-            canonical,
-            alias,
-            workdir,
-            origin: projectOrigin,
-            createdAt: projectCreatedAt,
-        };
-        const projectMetaPath = `/home/sprite/.devbox/projects/${fingerprint}.json`;
-        await runInitStep({
-            enabled: progressEnabled,
-            title: "Registering project",
-            fn: async () => {
-                let existing = {};
-                try {
-                    const raw = await client.readFile(canonical, {
-                        path: projectMetaPath,
-                    });
-                    const parsed = JSON.parse(Buffer.from(raw).toString("utf8"));
-                    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-                        existing = parsed;
-                    }
-                }
-                catch (error) {
-                    if (!(error instanceof SpritesApiError && error.status === 404)) {
-                        throw error;
-                    }
-                }
-                const existingCheckpoints = existing.checkpoints &&
-                    typeof existing.checkpoints === "object" &&
-                    !Array.isArray(existing.checkpoints)
-                    ? existing.checkpoints
-                    : {};
-                const stateCheckpoints = initState?.checkpoints ?? {};
-                const merged = {
-                    ...existing,
-                    ...projectMeta,
-                    checkpoints: { ...existingCheckpoints, ...stateCheckpoints },
-                };
-                await client.writeFile(canonical, projectMetaPath, Buffer.from(JSON.stringify(merged, null, 2)));
-            },
-        });
-        await runInitStep({
-            enabled: progressEnabled,
-            title: "Writing local metadata",
-            fn: async () => {
-                await writeRepoMarker(projectDir, { fingerprint, canonical, alias });
-            },
-        });
-        const skipSetupArtifactsStage = skipCodexApply || (shouldResume && initState?.steps.setupArtifactsStaged);
-        if (!skipSetupArtifactsStage) {
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Staging setup artifacts",
-                fn: async ({ status }) => {
-                    status.stage("Copying repo artifacts and staging external files");
-                    await stageRemoteSetupArtifacts({
-                        client,
-                        canonical,
-                        workdir: expandedWorkdir,
-                        artifactsBundlePath: remoteArtifactsBundlePath,
-                        artifactsManifestPath: remoteArtifactsManifestPath,
-                    });
-                },
-            });
-            await updateInitState({ steps: { setupArtifactsStaged: true } });
-        }
         if (!skipCodexCliEnsure) {
             await runInitStep({
                 enabled: progressEnabled,
@@ -2664,138 +880,70 @@ export const runInit = async (args) => {
                 },
             });
         }
-        if (!skipCodexApply) {
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Snapshotting filesystem (pre-setup)",
-                fn: async ({ status, fail, ok }) => {
-                    try {
-                        const checkpoint = await retryInitStep({
-                            status,
-                            title: "Snapshotting filesystem (pre-setup)",
-                            fn: async () => await recordCodexCheckpoint({
-                                client,
-                                canonical,
-                                phase: "preCodexSetup",
-                            }),
-                        });
-                        if (checkpoint.id) {
-                            ok(`Snapshot created: ${checkpoint.id}`);
-                        }
-                    }
-                    catch (error) {
-                        logger.warn("init_checkpoint_create_failed", {
-                            box: canonical,
-                            fingerprint,
-                            phase: "pre-codex-setup",
-                            error: error instanceof Error ? error.message : String(error),
-                        });
-                        fail("Snapshotting filesystem (pre-setup) (failed)");
-                        throw error;
-                    }
-                },
-            });
-            if (!skipServicesEnable) {
-                await runInitStep({
-                    enabled: progressEnabled,
-                    title: "Enabling devbox services",
-                    fn: async ({ status }) => {
-                        await enableRemoteServices({
-                            client,
-                            canonical,
-                            services: approvedPlan.services.backgroundServices,
-                            status,
-                        });
-                        await updateInitState({ steps: { servicesEnabled: true } });
-                    },
-                });
-            }
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Running Codex setup",
-                fn: async ({ status }) => {
-                    await runRemoteCodexSetup({
-                        client,
-                        canonical,
-                        expandedWorkdir,
-                        remoteSetupPath,
-                        remoteArtifactsBundlePath,
-                        remoteArtifactsManifestPath,
-                        socketInfo,
-                        status,
-                        pathSetup,
-                        entrypoints: approvedPlan.services.appEntrypoints,
-                        emitCodexOutput: !parsed.json,
-                        ...(initCodexProxyOptions
-                            ? { proxyOptions: initCodexProxyOptions }
-                            : {}),
-                    });
-                },
-            });
-            await updateInitState({ steps: { codexApplied: true } });
-            await updateRegistryProjectStatus(resolveInitStatus(initState?.steps, initState?.complete));
-            await runInitStep({
-                enabled: progressEnabled,
-                title: "Snapshotting filesystem (post-setup)",
-                fn: async ({ status, fail, ok }) => {
-                    try {
-                        const checkpoint = await retryInitStep({
-                            status,
-                            title: "Snapshotting filesystem (post-setup)",
-                            fn: async () => await recordCodexCheckpoint({
-                                client,
-                                canonical,
-                                phase: "postCodexSetup",
-                            }),
-                        });
-                        if (checkpoint.id) {
-                            ok(`Snapshot created: ${checkpoint.id}`);
-                        }
-                    }
-                    catch (error) {
-                        logger.warn("init_checkpoint_create_failed", {
-                            box: canonical,
-                            fingerprint,
-                            phase: "post-codex-setup",
-                            error: error instanceof Error ? error.message : String(error),
-                        });
-                        fail("Snapshotting filesystem (post-setup) (failed)");
-                        throw error;
-                    }
-                },
-            });
-        }
-        const finalStatus = resolveInitStatus(initState?.steps, initState?.complete);
-        const isComplete = finalStatus === "complete";
-        await runInitStep({
-            enabled: progressEnabled,
-            title: "Finalizing init",
-            fn: async () => {
-                await updateInitState({ complete: isComplete });
-                await updateRegistryProjectStatus(finalStatus);
-            },
+        const { setupPath, finalApprovedPlan, setupArtifacts, skipServicesConfig, skipServicesEnable, skipSetupUpload, } = await runSetupPlanFlow({
+            projectDir,
+            repoRoot,
+            localHomeDir,
+            shouldResume,
+            nonInteractive,
+            progressEnabled,
+            parsed,
+            getInitState,
+            updateInitState,
+            ...(initCodexProxyOptions ? { initCodexProxyOptions } : {}),
+            throwInitCanceled,
+        });
+        await runProvisionFlow({
+            client,
+            canonical,
+            expandedWorkdir,
+            repoRoot,
+            localHomeDir,
+            shouldResume,
+            parsed,
+            progressEnabled,
+            setupPath,
+            remoteSetupPath,
+            setupArtifacts,
+            skipSetupUpload,
+            remoteArtifactsBundlePath,
+            remoteArtifactsManifestPath,
+            remoteArtifactsPartsDescriptorPath,
+            getInitState,
+            updateInitState,
+            refreshRegistryProjectStatus: async () => await updateRegistryProjectStatus(resolveInitStatus(initState?.steps, initState?.complete)),
+        });
+        await runFinalizeFlow({
+            client,
+            canonical,
+            alias,
+            workdir,
+            projectDir,
+            fingerprint,
+            projectCreatedAt,
+            ...(projectOrigin !== undefined ? { projectOrigin } : {}),
+            finalApprovedPlan,
+            shouldResume,
+            nonInteractive,
+            progressEnabled,
+            parsed,
+            skipCodexApply,
+            skipServicesConfig,
+            skipServicesEnable,
+            remoteSetupPath,
+            remoteArtifactsBundlePath,
+            remoteArtifactsManifestPath,
+            socketInfo,
+            pathSetup,
+            ...(initCodexProxyOptions ? { initCodexProxyOptions } : {}),
+            throwInitCanceled,
+            getInitState,
+            updateInitState,
+            updateRegistryProjectStatus,
+            resolveInitStatus,
+            retryInitStep,
+            recordCodexCheckpoint,
         });
-        if (parsed.json) {
-            console.log(JSON.stringify({
-                ok: true,
-                status: finalStatus,
-                canonical,
-                alias,
-                workdir,
-                fingerprint,
-            }, null, 2));
-            return;
-        }
-        if (!isComplete) {
-            console.log(`devbox initialized (setup incomplete): ${alias} -> ${canonical}`);
-            console.log(`workdir: ${workdir}`);
-            console.log("next: run `dvb init --resume` from this repo to finish setup");
-            console.log("sprites: synced to control plane");
-            return;
-        }
-        console.log(`devbox initialized: ${alias} -> ${canonical}`);
-        console.log(`workdir: ${workdir}`);
-        console.log("sprites: synced to control plane");
     };
     await run();
 };